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As  smartphones  and  other  mobile  computing  devices  have  increased  in  ubiquity, 
advertisers  have  begun  to  realize  a  more  effective  way  of  targeting  users  and  a 
promising  area  for  revenue  growth:  location-based  advertising.  This  trend  brings 
to  bear  new  questions  about  whether  or  not  users  will  adopt  products  involving 
this  potentially  invasive  form  of  advertising  and  what  sorts  of  protections  should 
be  given  to  users.  Our  real-world  user  study  of  27  participants  echoes  earlier  find¬ 
ings  that  users  have  significant  privacy  concerns  regarding  sharing  their  locations 
with  advertisers.  However,  we  examine  these  concerns  in  more  detail  and  find  that 
they  are  complex  (e.g.,  relating  to  not  only  the  quantity  of  ads,  but  the  locations 
they  receive  them  at).  With  advanced  privacy  settings  users  stated  they  would  feel 
more  comfortable  and  share  more  information  than  with  a  simple  opt-in/opt-out 
mechanism. 


This  work  has  been  supported  by  a  Siebel  Scholarship,  an  NSF IGERT  grant,  and  NSF  grants 
CNS-0627513,  CNS-0905562.  Additional  support  has  been  provided  by  Nokia,  France  Tele¬ 
com,  Google,  the  CMU/Microsoft  Center  for  Computational  Thinking,  ARO  research  grant 
DAAD19-02-1-0389  to  Carnegie  Mellon  University’s  CyLab,  and  the  CMU/Portugal  Infor¬ 
mation  and  Communication  Technologies  Institute. 


Report  Documentation  Page 

Form  Approved 

OMB  No.  0704-0188 

Public  reporting  burden  for  the  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information, 
including  suggestions  for  reducing  this  burden,  to  Washington  Headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington 

VA  22202-4302.  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no  person  shall  be  subject  to  a  penalty  for  failing  to  comply  with  a  collection  of  information  if  it 
does  not  display  a  currently  valid  OMB  control  number. 

1.  REPORT  DATE 

Q^irp  2010  ^  REPORT  TYPE 

3.  DATES  COVERED 

00-00-2010  to  00-00-2010 

4.  TITLE  AND  SUBTITLE 

When  Are  Users  Comfortable  Sharing  Locations  with  Advertisers? 

5a.  CONTRACT  NUMBER 

5b.  GRANT  NUMBER 

5c.  PROGRAM  ELEMENT  NUMBER 

6.  AUTHOR(S) 

5d.  PROJECT  NUMBER 

5e.  TASK  NUMBER 

5f.  WORK  UNIT  NUMBER 

7.  PERFORMING  ORGANIZATION  NAME(S)  AND  ADDRESS(ES) 

Carnegie  Mellon  University, School  of  Computer 

Science, Pittsburgh, PA, 15213 

8.  PERFORMING  ORGANIZATION 

REPORT  NUMBER 

9.  SPONSORING/MONITORING  AGENCY  NAME(S)  AND  ADDRESS(ES) 

10.  SPONSOR/MONITOR'S  ACRONYM(S) 

11.  SPONSOR/MONITOR'S  REPORT 
NUMBER(S) 

12.  DISTRIBUTION/AVAILABILITY  STATEMENT 

Approved  for  public  release;  distribution  unlimited 

13.  SUPPLEMENTARY  NOTES 

14.  ABSTRACT 

15.  SUBJECT  TERMS 

16.  SECURITY  CLASSIFICATION  OF:  17.  LIMITATION  OF 

_ _ _  ABSTRACT 

18.  NUMBER  19a.  NAME  OF 

OF  PAGES  RESPONSIBLE  PERSON 

a.  REPORT  b.  ABSTRACT  c.  THIS  PAGE  Same  OS 

unclassified  unclassified  unclassified  Report  (SAR) 

12 

Standard  Form  298  (Rev.  8-98) 

Prescribed  by  ANSI  Std  Z39-18 


Keywords:  privacy,  user  studies,  advertising,  expressiveness,  location-based  sharing 


1 


Contents 

11  Introduction! 

12  Related  Workl 

3  Methodologyl 


14  Res  u  I  til 


4.1 

Survey  Results  . 

4.1.1  General  Privacy  Concerns . 

4.1.2  Privacy  Concerns  Regarding  Advertisers  . 

|4.2 

Quantitative  Results  Based  On  Location  Audits . 

15  Conclusion! 


6  Acknowledgments! 

IReferenceil 


1 

2 

2 

3 

3 

3 

5 

7 

7 

7 


1  Introduction 


In  February  2010,  the  United  States  House  of  Representatives  Subcommittee  on  Commerce, 
Trade,  and  Consumer  Protection  held  a  joint  hearing  on  location  information  for  commercial 
purposes.  In  chairman  Bobby  L.  Rush’s  opening  statement,  he  said: 

“To  some  extent,  location-based  services  can  be  viewed  as  a  sub-category  of  be¬ 
havioral  tracking  in  that  they  can  quickly,  and  cheaply,  tell  advertisers  more  than 
contextual  advertising  ever  could  about  someone’s  preferences,  habits,  and  pat¬ 
terns.”  m 

With  intelligent  mobile  devices  growing  in  popularity,  it  is  possible  for  future  ads  to  com¬ 
monly  be  targeted  based  on  one’s  location.  Google’s  and  Apple’s  recent  purchases  of  AdMob 
and  Quattro  Wireless,  are  examples  of  two  major  technology  companies  pushing  into  mobile 
and  location-based  advertising. 

Additionally,  as  location-sharing  continues  to  grow  as  a  social  phenomenon  (e.g.,  the  recent 
launch  of  Facebook’s  Places  continues  to  move  this  trend  towards  the  mainstream),  we  have  al¬ 
ready  started  to  see  location-based  coupons  being  offered  to  users.  Foursquare,  a  popular  mo¬ 
bile  location-sharing  application,  is  currently  leading  this  push  by  allowing  small  businesses 
and  national  chains  (e.g.,  Starbucks)  to  offer  recurring,  frequency-based,  and  loyalty-based 
coupons  to  over  three  million  users  J9|.  Businesses  that  participate  in  this  program  are  also 
given  access  to  certain  personally  identifiable  statistics,  such  as  the  most  recent  and  frequent 
visitors  to  their  venues,  without  users’  awareness. 

As  this  commercial  landscape  expands,  we  ask  what  types  of  privacy  settings  should  be 
given  to  users  to  encourage  broader  adoption?  While  location-sharing  with  friends,  family 
members,  and  members  of  social  networks  has  been  studied  in  great  detail  by  researchers  III  12 
l8lfT0lfl2l.  the  controlled  sharing  of  location  information  with  advertisers  is  largely  unstudied. 

In  this  paper,  we  present  an  empirical  investigation  of  peoples’  attitudes  towards  location¬ 
sharing  with  mobile  advertisers.  By  analyzing  three  weeks  of  location  audits,  combined  with 
survey  responses,  we  show  users’  strong  privacy  concerns  may  hinder  the  adoption  of  systems 
leveraging  this  potentially  invasive  form  of  advertising.  However,  we  also  find  that  advanced 
privacy  settings  may  help  alleviate  some  of  these  concerns. 


2  Related  Work 

Many  research  groups  have  developed  location-based  services,  including  PARC’s  Active 
Badges  03,  Barkhuus’s  Active-Campus  (T|,  Intel’s  PlaceLab  [0,  Carnegie  Mellon’s  Locac- 
cino  02),  and  Burghardt’s  Mobile  PET  work  J3).  While  much  of  this  work  was  hampered 
with  adoption  and  technical  issues  in  its  infancy,  more  recent  work  has  successfully  investi¬ 
gated  deployed  systems  where  users’  locations  are  queried  in  the  real  world.  These  systems, 
and  their  commercial  counterparts,  have  almost  always  included  some  sort  of  privacy  mod¬ 
ule,  since  even  in  early  wireless  advertising  efforts  it  had  been  reported  that  participants  had 
privacy  concerns  regarding  location-based  advertising  SI-  Yet,  while  this  module  was  always 
present  in  discussions  JT),  it  has  normally  been  regarded  as  a  simple  “opt-in”  or  “opt-out” 
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mechanism.  Even  in  focused  consumer  inquiries,  the  discussion  is  largely  focused  on  whether 
or  not  users  would  be  willing  to  opt-in  mm. 

More  recently,  some  systems  have  begun  to  provide  more  privacy  protective  measures  than 
simple  opt-in  mechanisms,  including:  per-person  settings,  granularity/resolution  control,  in¬ 
visibility  modes,  and  even  time  and  location  based  rules.  A  survey  of  89  commercial  location¬ 
sharing  applications  showed  that,  in  2009,  more  than  half  had  some  form  of  privacy  control, 
with  varying  complexity  EL  However,  in  all  of  these  commercial  and  research  applications 
the  privacy  controls  protect  users  from  their  friends,  not  the  companies  themselves  or  advertis¬ 
ing  partners. The  bridge  between  applying  advanced  privacy  controls  for  location-sharing  with 
friends,  family  members,  and  social  networks  has  not  been  considered  for  location-sharing 
with  advertisers.  Our  work  unifies  these  two  bodies  of  work,  investigating  when  consumers 
and  advertisers  would  benefit  from  these  advanced  models. 

3  Methodology 

In  November  2009,  we  conducted  a  study  requiring  users  to  carry  a  Nokia  N95  smartphone 
equipped  with  our  location-tracking  software,  and  use  it  as  their  primary  phone  for  three 
weeks.  Once  a  day,  users  were  required  to  visit  our  web  application  where  they  were  asked 
whether  or  not  they  would  have  been  comfortable  sharing  each  location  they  visited  with  a 
number  of  pre-defined  groups,  one  of  which  was  advertisers.  For  a  complete  description  of 
the  methodology  and  technology  used  in  executing  this  user  study  (including  screen  shots  of 
the  web  application)  please  refer  to  el 

Users  were  recruited  with  fliers  and  newsgroup  postings  within  our  university  community. 
Our  users  were  required  to  have  an  AT&T  or  T-Mobile  phone  contract,  and  an  unlimited  data 
plan  (or  the  ability  to  obtain  one).  We  compensated  participants  $30  for  their  participation  and 
an  additional  $20-$30  to  reimburse  their  data  plan  expenses.  While  we  had  111  people  fill  out 
our  pre-study  survey,  only  27  users  completed  the  study  (due  to  ineligibility  and  drop-outs). 

Each  time  a  user  visited  our  web  application,  it  iterated  through  his  or  her  recent  locations 
in  order,  and  it  displayed  each  location  on  a  map.  For  each  location  it  then  asked,  “Would 
you  have  been  comfortable  sharing  your  location  during  this  time  span  with  Advertisers?” 
(where  “during  this  time  span”  was  replaced  with  the  actual  time  the  user  visited  the  location). 
Users  could  then  respond  “Yes,  during  this  entire  time,”  “No,  not  during  any  of  this  time,”  or 

“Yes,  during  part  of  this  time _ ”  Users  completed  these  questions  for  each  location  at  which 

they  spent  more  than  15  minutes.  If  a  user  visited  a  location  at  two  different  times  on  the  same 
day,  it  was  audited  separately  for  each  visit. 


4  Results 

Our  results  are  broken  into  two  sections:  a  summary  of  user-reported  information  from  the  pre- 
and  post-study  surveys,  and  a  quantitative  analysis  of  users’  daily  audits  concerning  sharing 
their  locations  with  advertisers. 
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4.1  Survey  Results 

Our  study  included  27  participants  (20  male,  7  female),  all  affiliated  with  our  university  com¬ 
munity  (15  undergraduates,  10  graduate  students,  2  staff  members).  While  our  users  tended 
to  be  young  (average  age  was  22.9),  more  tech-savvy,  and  most  reported  daily  use  of  Face- 
book,  we  believe  this  community  is  representative  of  early  adopters  of  the  technologies  that 
are  likely  to  expose  them  to  location-based  advertising. 


4.1.1  General  Privacy  Concerns 

Our  post-study  survey  sought  to  capture  users’  attitudes  relating  to  two  topics:  general  privacy 
concern  and  concerns  related  specifically  to  advertising.  A  summary  of  user  responses  related 
to  general  privacy  concerns  can  be  found  in  Figure  [T]  Overall,  users  report  strong  concerns 
across  the  six  questions  we  asked.  The  strongest  response  was  in  regards  to  corporate  infor¬ 
mation  exchange,  we  stated:  “Online  companies  should  never  share  personal  information  with 
other  companies  unless  it  has  been  authorized  by  the  individuals  who  provided  the  informa¬ 
tion,"  and  19  of  24  users  responded  with 
agreement. 

Companies  should  never  share 

my  info  unless  authorized  by  me 

Companies  should  have  more 
steps  to  stop  unauthorized  access 

Important  to  be  knowledgeable 
about  personal  info  use 

Companies  should  have  better 
procedures  to  correct  errors 

Concerned  about  threats  to  my 
personal  privacy  today 

Concerned  companies  have 
too  much  personal  info 


a  7  on  a  7-point  Likert  scale,  representing  a  strong 
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Strongly  disagree  Strongly  agree 


Figure  1:  User  responses  about  privacy  concerns  after  the  three  week  study.  Answers  were 
reported  on  a  7-point  Likert  scale,  from  1  (Strongly  disagree)  to  7  (Strongly  agree). 
Averages  and  95%  confidence  intervals  are  shown. 


4.1.2  Privacy  Concerns  Regarding  Advertisers 

The  pre-study  survey  contained  one  question  related  to  advertisers,  asking  participants  to 
“rate  how  comfortable  you  would  be  if  advertisers  (e.g.,  in  order  to  send  you  promotions 
or  coupons)  could  view  your  location,”  either  always,  at  user-specified  times,  or  user-specified 
locations.  On  a  7-point  Likert  scale,  where  1  was  labeled  “Not  comfortable”  and  7  was  “Fully 
comfortable,”  users  reported  an  average  of  2.6  for  always,  3.6  with  specified  times,  and  4.3 
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with  specified  locations.  Both  time  and  location  specifications  made  users  significantly  more 
comfortable  ( p  <  0.01  for  both,  paired  t-tests,  time:  t  =  3.11,  df  =  24;  location:  t  =  4.28, 
df  =  24)  and  location  specifications  were  significantly  more  comforting  than  time  ( p  <  0.01, 
t  =  2.98,  df  =  24). 

The  post-study  survey  contained  questions  related  to  advertisers.  The  first  asked  “how  bad” 
it  would  be  if  a  user’s  location  was  disclosed  to  advertisers  when  they  did  not  want  it  to  be, 
and  also  the  reverse  (i.e.,  a  non-disclosure  when  disclosure  was  wanted).  On  a  7-point  Likert 
scale,  where  1  was  labeled  “Not  bad  at  all”  and  7  was  “Very,  very  bad,”  participants  reported 
an  average  discomfort  level  of  1 .67  for  mistakenly  not-disclosing,  and  an  average  discomfort 
of  4.74  for  mistakenly  disclosing  a  location.  These  results  suggest  that,  as  expected,  a  missed 
opportunity  is  only  a  minor  concern  to  our  users,  whereas  disclosing  a  privacy-sensitive  loca¬ 
tion  to  advertisers  has  a  significantly  higher  cost. 

We  also  asked  users  what  the  most  important  factors  would  be  in  allowing  advertisers  access 
to  their  locations.  The  results  from  this  question,  again  on  a  7-point  Likert  scale  from  “Not 
important”  to  “Very,  very  important,”  are  displayed  in  Figure  [2]  From  the  reported  responses, 
a  user’s  location  and  the  quantity  of  ads  received  mattered  significantly  more  than  the  brand 
of  the  advertisers  and  time  of  day. 

The  number  of 
ads  you  receive 

The  location 
you  are  at 

The  type  of 
the  advertisers 

The  type  of  product 
being  advertised 

The  time  of  day 

The  brand  of  the 
advertisers 
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Not  important  Very,  very  important 

Figure  2:  User  responses  on  qualities  of  advertisers  which  would  impact  their  future  location¬ 
sharing  decisions.  Answers  were  reported  on  a  7-point  Likert  scale,  from  1  (Not 
important)  to  7  (Very,  very  important).  Averages  and  95%  confidence  intervals  are 
shown. 
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4.2  Quantitative  Results  Based  On  Location  Audits 


With  over  7,500  hours  of  audited  locations,  we  sought  to  quantify  when  users  would  be  willing 
to  share  their  real  locations  with  advertisers,  and  how  complex  their  preferences  are  regarding 
this  sharing. 

In  general,  users  were  significantly  more  willing  to  share  their  locations  on  weekdays  from 
9:00am-5:00pm  (average  of  47.5%  time  shared  during  business  hours  compared  to  35.8%  at 
other  times).  The  subjects  were  also  significantly  more  willing  to  share  their  second  and  third 
most  visited  locations  than  their  most  visited  location,  which  were  likely  their  homes  (average 
of  29%  time  shared  at  first  most  visited,  compared  to  55%  and  41%  at  second  and  third  most 
visited  locations,  respectively). 

For  the  remainder  of  the  analysis,  we  will  compare  the  following  six  privacy-setting  mech¬ 
anisms  based  on  the  percentage  of  time  our  users  would  have  shared  under  each: 

•  Opt-in  -  the  most  common  privacy-setting.  It  simply  allows  a  user  to  opt-in  or  opt-out 
of  sharing  with  advertisers. 

•  Time  -  slightly  more  complex  than  Opt-in.  A  single  rule  specifies  a  time  span  during 
which  a  user  is  willing  to  share  his  or  her  location  (e.g.,  between  8am-5pm). 

•  Time  with  weekends  (Time+)  -  a  modification  of  Time  that  allows  specification  of  rules 
applying  to  weekdays  only,  weekends  only,  or  both. 

•  Location  (Loc)  -  allows  a  user  to  give  access  to  their  location  when  they  are  in  a  pre¬ 
specified  area.  A  single  rule  is  defined  by  a  latitude/longitude  rectangle. 

•  Location  and  time  (Loc/Time)  -  allows  for  rules  that  are  combinations  of  Loc  and  Time 
rules  (e.g.,  “grant  access  from  3pm-7pm  when  I  am  at  location  A  or  B.”) 

•  Location  and  time  with  weekends  (Loc/Time+)  -  modifies  Loc/Time  to  allow  rules  that 
apply  to  weekdays,  weekends,  or  both. 

Using  the  detailed  privacy  preferences  we  collected,  we  calculated  the  most  accurate  possi¬ 
ble  set  of  rules,  or  policy ,  for  each  subject,  under  each  of  the  different  privacy-setting  mecha¬ 
nisms.  In  order  to  account  for  differences  between  subjects,  we  calculated  the  policies  under 
varying  assumptions  about  the  cost  associated  with  revealing  a  private  location,  which  we 
denote  as  c,  and  the  maximum  number  of  rules  users  would  be  willing  to  specify. 

The  most  accurate  policy  is  the  one  that  reveals  as  much  time  possible,  while  minimizing  the 
amount  of  time  mistakenly  revealed.  The  relative  weights  assigned  to  time  correctly  revealed 
and  mistakenly  revealed  are  determined  by  c.  A  small  value  of  c,  such  as  c  =  1,  is  equivalent 
to  the  assumption  that  our  users  would  have  been  equally  comfortable  with  a  mistaken  reveal 
as  a  correct  reveal.  Larger  values  of  c,  such  asc=  100,  are  equivalent  to  the  assumption  that 
our  users  would  always  err  on  the  safe  side,  and  protect  private  locations  by  restricting  their 
policies  to  never  reveal  them. 

We  report  the  average  time  shared  with  advertisers,  for  each  of  the  privacy-setting  mecha¬ 
nisms,  under  different  values  of  c  in  Figure  [3]  Here  we  see  that  as  the  cost  of  mistakenly  re¬ 
vealing  a  location  increases,  the  policies  become  more  restrictive  and  the  average  time  shared 
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Cost  of  mistakenly  revealing  a  location  (log  scale) 


Figure  3:  The  relationship  between  percentage  of  time  shared  with  advertisers  under  different 
privacy-setting  mechanisms  as  the  cost  of  mistakenly  revealing  a  location  increases. 
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Figure  4:  The  percentage  of  time  a  user  would  share  their  location  with  advertisers  under  dif¬ 
ferent  privacy=setting  mechanisms,  given  a  limited  number  of  user-specified  rules. 


decreases.  However,  more  complex  privacy-setting  mechanisms,  such  as  Loc/Time+,  resist 
this  decrease,  and  allow  policies  that  maximize  the  amount  of  time  shared  while  preventing 
high-cost  mistakes. 

For  even  moderate  values  of  c,  such  as  c  >  15,  more  complex  mechanisms,  such  as  Loc/- 
Time+  and  Loc/Time,  result  in  nearly  three  times  as  much  sharing  as  Opt-in,  and  this  dif¬ 
ference  is  statistically  significant  ( [p  <  0.05  for  Loc/Time+  and  p  <  0.1  for  Loc/Time).  This 
substantial  increase  in  sharing  with  large  values  of  c  is  particularly  relevant,  given  that  our  sub¬ 
jects  reported  being  very  concerned  about  sharing  locations  marked  private  with  advertisers  in 
our  post-study  survey. 

Additionally,  we  find  that  the  increases  in  sharing  from  more  complex  setting  types  can 
be  realized,  even  if  users  are  only  willing  to  make  a  small  number  of  rules.  As  displayed  in 
Figure  [4j  with  c  =  20,  we  see  a  substantial  increase  in  the  percentage  of  time  a  user  would 
share  his  or  her  location  with  only  a  single  rule.  With  two  rules  the  differences  between 
the  complex  mechanisms,  Loc/Time+  and  Loc/Time,  and  Opt-in  are  statistically  significant 
{p  <  0.05)  and  marginally  significant  (p  <  0.1),  respectively.  And,  as  the  cost  of  mistakes 
increases,  the  increase  in  sharing  under  more  complex  mechanisms  with  small  numbers  of 
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rules  is  even  more  dramatic.  For  example,  when  c  =  100  we  see  an  almost  three  times 
increase  in  sharing  over  Opt-in  with  a  single  Loc/Time+  rule,  and  this  increase  is  statistically 
significant  ( p  <  0.05). 


5  Conclusion 

Location-based  advertising  has  the  potential  to  fund  the  growth  of  future  mobile  computing 
systems.  Our  results  suggest  that  users’  strong  privacy  concerns  may  hinder  this  potentially 
invasive  form  of  advertising,  as  early  efforts  reach  the  market.  We  also  find  that  advanced 
privacy  settings  may  help  alleviate  some  of  these  concerns,  making  users  more  comfortable 
with  location-based  advertising. 

We  presented  an  empirical  investigation  showing  that  users’  privacy  preferences  with  re¬ 
gards  to  sharing  locations  with  advertisers  are  complex.  Our  survey  findings  and  analysis 
conducted  on  over  7,500  hours  of  location  audits,  allowed  us  to  characterize  these  privacy 
preferences  in  detail.  We  find  that  if  users  are  given  only  an  opt-in/opt-out  mechanism,  a  large 
percentage  will  not  be  able  to  specify  their  true  privacy  preferences,  and  may  simply  stop  shar¬ 
ing  entirely.  These  findings  suggest  that  designing  future  systems  with  more  complex  privacy 
settings  will  benefit  all  parties,  increase  sharing,  and  place  more  control  in  the  hands  of  users. 
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